There's only one excuse for storing passwords in plaintext - to perform challenge-response auth, so passwords can't be sniffed. A tradeoff between line and data

There's only one excuse for storing passwords in plaintext - to perform challenge-response auth, so passwords can't be sniffed. A tradeoff between line and database security. Of course, this is only applicable in cases when two special conditions are met: a) The line is considered not secure enough. YMMV here. b) There's no possibility to use some kind of more secure method (for example, deploy a PKI, ZKPP or PAKE). Like when you're ISP offering PPPoE access (lots of SOHO routers just don't know about EAP at all). So this is definitely not about web sites (as they could - and really should - use HTTPS).